Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was logged into my server earlier today, and now when i go to SSH i get the error "SSH Connection Refused" i'm running Ubuntu Hardy. The server is still working, and serving web-pages i just cannot get in. Last time i was on the server, i didn't change any of the iptables. Is there anyway to troubleshoot this issue? Update: I do have access to a browser based console to the server. Though it is painfully slow, i can investigate further.

Update: It looks like ssh isn't running on my port when i use lsof. I ran sudo /etc/init.d/ssh restart and nothing happens, and still nothing is running on my ssh port. When i check /var/log/auth.log i get:

sudo: pam_unix(sudo:session): session opened for xxxx root by yyyy(uid=0)
sudo: pam_unix(sudo:session): session closed for user xxxx by yyyy(uid=0)

which looks like it is opening then immediately closing the session.

share|improve this question
    
Is there anything like denyhosts or fail2ban installed? If yes, can you check to make sure that you didn't trigger something to lock yourself out? –  Zoredache Mar 22 '10 at 5:58
add comment

5 Answers 5

up vote 3 down vote accepted

I would suggest the following in addition to the answers already present. Ensure you have some way to restore you're firewall after carefully checking its ruleset.

Disclaimer: if this device is an internet facing machine, this will drop all firewall protection from all interfaces, and could lead to your box getting owned.

# iptables --flush
# iptables -P INPUT ACCEPT
# iptables -P FORWARD ACCEPT
# iptables -P OUTPUT ACCEPT
# /etc/init.d/openssh-server restart

Then retry connection via ssh, if that fails check /var/log/auth.log.

You can also use

# lsof -i TCP:22 

to see if the ssh port is opened and what IP address it's listening on.

edit: re: update, that doesn't appear to be ssh related (it seems to be in relation to sudo privilege elevation.

try tail -f /var/log/auth.log while attempting to connect via ssh.

Connection refused mean that the connection was explicitly rejected by either a firewall or the daemon it's self.

A normal connection would look something like this:

Mar 23 13:32:32 <hostname> sshd[20100]: Accepted password for <user> from xxx.xxx.xxx.xxx port xxxxx ssh2
Mar 23 13:32:32 <hostname> sshd[20102]: (pam_unix) session opened for user <user> by (uid=0)

While an authentication failure will look like this:

Mar 23 13:35:54 <hostname> sshd[20177]: Failed password for <user> from xxx.xxx.xxx.xxx port xxxxx ssh2

If it were blocked by sshd for some reason, that will be eluded to in the auth log, if it were blocked by the firewall (note the firewall may be on the host, client or somewhere in between) you'll see nothing.

Get back to us if that's the case, from there it'll be tcp dump on the client, server and any intermediary routers.

share|improve this answer
1  
you should set the default policies to accept before clearing the ruleset. –  Justin Mar 22 '10 at 11:29
    
True, that is recommended generally to prevent locking yourself out but it shouldn't matter if you're physically at the console. edit: just read about webconsole, in that case yes, set the chain policies before the flush. –  Aaron Tate Mar 22 '10 at 23:16
1  
I was asking the wrong quetsions, it looks like my ssh process was killed. Thanks, without your help i never would have figured it out! –  Schneems Mar 23 '10 at 14:49
add comment

Well, it could be that the ssh server is down for whatever reason - one way to check for it is using netcat - netcat should yield some sort of response. I'd also give it a shot from another ip address to be safe.

share|improve this answer
add comment

Have a look at your hosts.deny file! Maybe somehow your IP got in there.

share|improve this answer
    
hosts.deny can not cause the connection to be refused –  Justin Mar 22 '10 at 11:28
    
Justin, you're actually right! It might still be a hosts.deny integration with the firewall that can produce this behaviour. (Though admittedly unlikely from the updated info.) –  MacLemon Mar 23 '10 at 16:19
add comment

CHeck the /var/log/syslog file this should have some more information in it on why the ssh daemon is not able to startup, just checking as well you dont have a zombie ssh daemon running on your machine which could be causing you some issues (check the output of ps -ef | grep ssh)?

share|improve this answer
add comment

Console access -> Check logs for SSHd -> Fix.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.